Two ports cover panel administration and client subscriptions
S-UI runs a browser panel on port 2095 and a subscription service on port 2096 by default. The panel creates sing-box inbounds and outbounds, manages several clients, sets traffic caps and expiry dates, and shows connection and system statistics. It can emit link, JSON, and Clash subscription formats. That is a useful bundle for someone who understands the underlying proxy choices but would rather manage routine changes in a form than keep rewriting sing-box configuration.
The measured checkout was modest at 369 files, about 46,119 source lines, and 3.7 MB. Its scope is broader than the size suggests because the Go backend embeds the compiled frontend and wraps sing-box itself. Data lives in SQLite, while separate packages handle API requests, clients, routing, statistics, subscriptions, backups, and configuration migration. The frontend is a Git submodule, so contributors changing the interface work across two repositories.
Six interface languages sit over a long protocol list
The S-UI README documents English, Farsi, Vietnamese, Russian, Simplified Chinese, and Traditional Chinese. Its protocol list covers HTTP and SOCKS basics alongside VLESS, VMess, Trojan, Shadowsocks, Hysteria, TUIC, ShadowTLS, and other sing-box options. One user can have multiple inbounds, and generated subscriptions let compatible clients consume the resulting configuration without receiving panel access.
A 466-package install is a reminder that the tidy binary interface rests on a substantial dependency graph. S-UI also owns operational state: client identities, quota counters, expiry rules, certificates, traffic history, and the configuration that starts the proxy core. A wrong route or exposed panel can affect every client on that server. The browser saves typing, but it does not remove the need to understand DNS, ports, transport settings, and firewall exposure.
What happened when we ran it
Our sandbox installed commit 686f233 in 121 seconds and pulled 466 packages. The build succeeded in 137 seconds. That commit contains the sing-box 1.14 migration work released as v1.6.0, and the successful compile is meaningful because the backend includes protocol-specific build tags and CGO-dependent pieces. The run used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and the golang:1.24-bookworm image.
All 12 Go tests passed in 24 seconds, with 0 failures. The repository had 3 CI workflow files, a Dockerfile, and a compose file, although it had no directory literally named tests. We did not measure proxy throughput, connection latency, browser behavior, or a live upgrade, so the passing suite answers a narrow question: this pinned source installed, compiled, and cleared its available Go tests in our stated environment.
Default admin credentials require work before network exposure
The documented first login is admin/admin, with the panel at /app/ on port 2095. S-UI supports HTTPS, but the installation instructions put the domain and certificate in the operator's hands. Change the credentials before allowing outside access, restrict the panel port, and persist both the database and certificate directories when using Docker. The compose example publishes 2 ports and mounts both paths.
Teams that require a second login factor should stop here. Pull request 887, opened in November 2025, proposes TOTP and remained open when checked. Session authentication and API tokens exist, but the current README does not document TOTP as a released feature. The repository also says the software is for personal learning and communication and explicitly tells readers not to use it in production. That warning sets a clear support boundary.
v1.6.0 migrates most sing-box 1.14 settings once
The v1.6.0 release notes say stored configurations move to sing-box 1.14 shapes automatically on first start. Two DNS cases are excluded because automatic rewriting could change name resolution: rules using legacy address filters, and the deprecated strategy rule action. S-UI logs those cases with an upstream migration link. An upgrade therefore needs a database backup, log review, and a manual DNS check before clients depend on the new configuration.
Our 12 passing tests include migration-oriented Go coverage at the measured commit, but the contributor guide says there are no *_test.go files and recommends manual checks. That text is stale. The same contributor guide at 686f233 correctly explains the frontend submodule, CGO compiler requirement, build tags, and backend-only route. Documentation is useful for getting started, yet maintainers should verify commands against the source instead of treating every status statement as current.
September 2026 activity is current and the open queue is small
GitHub showed 9,851 stars and 6 combined open issues and pull requests when fetched on September 7, 2026. The last push was September 2, one day after v1.6.0, and the latest open issue was filed September 4. Three of the 6 open items were pull requests. Those dates show active maintenance and user reports together; the combined count is not a count of confirmed bugs.
The open reports also reveal ordinary panel friction. Issue 1249 says enabling Multi-Domain prefixes a Clash subscription node name with a number. Issue 1247 asks for a maintenance mode that temporarily stops the core while routes or panel settings change. Neither request invalidates the 137-second successful build, but both matter to operators who promise stable names or scheduled maintenance behavior to users.
S-UI best suits a hands-on single-server operator
S-UI earned a serious look because our 466-package install completed, its 137-second build passed, and all 12 tests succeeded. The panel covers far more than a basic proxy toggle, especially for several users sharing one sing-box host. Its sweet spot is a technically capable self-hoster who will change the default login, supply TLS, back up SQLite, read migration logs, and test subscriptions after upgrades.
Larger deployments should compare 3x-ui, Hiddify Manager, and Marzban before committing. Those projects make different choices around Xray, deployment structure, and node management. S-UI remains the sharper choice when sing-box is fixed and one panel should own users, routes, and subscriptions. The maintainer's production disclaimer still matters: passing 12 tests makes evaluation easier, but it does not turn the project into a supported network appliance.